From 5582c2ced73610253960f0d2a0c18d742bed6e47 Mon Sep 17 00:00:00 2001 From: ng-jianshn Date: Fri, 13 Dec 2024 14:25:59 +0800 Subject: [PATCH 01/21] Update credential.json --- tools/deploy/module0/credential.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/deploy/module0/credential.json b/tools/deploy/module0/credential.json index 648e7c4c..217b8014 100644 --- a/tools/deploy/module0/credential.json +++ b/tools/deploy/module0/credential.json @@ -1,7 +1,7 @@ { "name": "gha-oidc", "issuer": "https://token.actions.githubusercontent.com", - "subject": "repo:/AKS-DevSecOps-Workshop:ref:refs/heads/main", + "subject": "repo:ng-jianshn/AKS-DevSecOps-Workshop:ref:refs/heads/main", "audiences": ["api://AzureADTokenExchange"], "description": "Workload Identity for AKS DevSecOps repo - branch mod 4" } From c13a1e4fc2a0095ba913d8e1d39903b2e8f32352 Mon Sep 17 00:00:00 2001 From: ng-jianshn Date: Fri, 13 Dec 2024 14:42:35 +0800 Subject: [PATCH 02/21] Update aks.bicep --- tools/deploy/module0/aks.bicep | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/deploy/module0/aks.bicep b/tools/deploy/module0/aks.bicep index c590a438..c89cec72 100644 --- a/tools/deploy/module0/aks.bicep +++ b/tools/deploy/module0/aks.bicep @@ -19,7 +19,7 @@ param location string = resourceGroup().location param agentCount int = 3 @description('VM size availability varies by region. If a node contains insufficient compute resources (memory, cpu, etc) pods might fail to run correctly. For more details on restricted VM sizes, see: https://docs.microsoft.com/azure/aks/quotas-skus-regions') -param agentVMSize string = 'Standard_DS2_v2' +param agentVMSize string = 'Standard_D4pds_v5' // create azure container registry resource acr 'Microsoft.ContainerRegistry/registries@2023-01-01-preview' = { From b941a170fbd71f77d62f8bf5f3e2b11e82db006a Mon Sep 17 00:00:00 2001 From: ng-jianshn Date: Fri, 13 Dec 2024 14:58:17 +0800 Subject: [PATCH 03/21] Update aks.bicep --- tools/deploy/module0/aks.bicep | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/deploy/module0/aks.bicep b/tools/deploy/module0/aks.bicep index c89cec72..bdfdcff9 100644 --- a/tools/deploy/module0/aks.bicep +++ b/tools/deploy/module0/aks.bicep @@ -19,7 +19,7 @@ param location string = resourceGroup().location param agentCount int = 3 @description('VM size availability varies by region. If a node contains insufficient compute resources (memory, cpu, etc) pods might fail to run correctly. For more details on restricted VM sizes, see: https://docs.microsoft.com/azure/aks/quotas-skus-regions') -param agentVMSize string = 'Standard_D4pds_v5' +param agentVMSize string = 'Standard_D4ds_v5' // create azure container registry resource acr 'Microsoft.ContainerRegistry/registries@2023-01-01-preview' = { From 0afba2524795d1cb50e33ac96add3a7cf40c481b Mon Sep 17 00:00:00 2001 From: ng-jianshn Date: Fri, 13 Dec 2024 15:03:11 +0800 Subject: [PATCH 04/21] Update aks.bicep --- tools/deploy/module0/aks.bicep | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/deploy/module0/aks.bicep b/tools/deploy/module0/aks.bicep index bdfdcff9..d1cceafd 100644 --- a/tools/deploy/module0/aks.bicep +++ b/tools/deploy/module0/aks.bicep @@ -36,7 +36,7 @@ resource acr 'Microsoft.ContainerRegistry/registries@2023-01-01-preview' = { } } -resource aks 'Microsoft.ContainerService/managedClusters@2022-09-02-preview' = { +resource aks 'Microsoft.ContainerService/managedClusters@2024-02-01' = { name: clusterName location: location identity: { From 82c54465ff4f9cb532691d79ed2358588cf7e262 Mon Sep 17 00:00:00 2001 From: ng-jianshn Date: Fri, 13 Dec 2024 15:17:53 +0800 Subject: [PATCH 05/21] Update infra-deployment-workflow.yml --- .github/workflows/infra-deployment-workflow.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/infra-deployment-workflow.yml b/.github/workflows/infra-deployment-workflow.yml index 724570f8..5d49886f 100644 --- a/.github/workflows/infra-deployment-workflow.yml +++ b/.github/workflows/infra-deployment-workflow.yml @@ -32,7 +32,7 @@ jobs: # Deploy Bicep file - name: deploy - uses: azure/arm-deploy@v1 + uses: azure/arm-deploy@v2 with: subscriptionId: ${{ secrets.AZURE_SUBSCRIPTION_ID }} resourceGroupName: ${{ secrets.CLUSTER_RESOURCE_GROUP }} @@ -50,4 +50,4 @@ jobs: run: | CLUSTER_NAME=$(az aks list --resource-group ${{ secrets.CLUSTER_RESOURCE_GROUP }} --query "[].name" -o tsv) ACR_NAME=$(az acr list --resource-group ${{ secrets.CLUSTER_RESOURCE_GROUP }} --query "[].name" -o tsv) - az aks update -n $CLUSTER_NAME -g ${{ secrets.CLUSTER_RESOURCE_GROUP }} --attach-acr $ACR_NAME \ No newline at end of file + az aks update -n $CLUSTER_NAME -g ${{ secrets.CLUSTER_RESOURCE_GROUP }} --attach-acr $ACR_NAME From 1fdbcfcea9afe669f22490407186f4684430372f Mon Sep 17 00:00:00 2001 From: ng-jianshn Date: Fri, 13 Dec 2024 15:27:49 +0800 Subject: [PATCH 06/21] Update infra-deployment-workflow.yml --- .github/workflows/infra-deployment-workflow.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/infra-deployment-workflow.yml b/.github/workflows/infra-deployment-workflow.yml index 5d49886f..7f27482f 100644 --- a/.github/workflows/infra-deployment-workflow.yml +++ b/.github/workflows/infra-deployment-workflow.yml @@ -44,6 +44,7 @@ jobs: - name: az feature register run: | az feature register --namespace "Microsoft.ContainerService" --name "EnableWorkloadIdentityPreview" + az provider register -n Microsoft.ContainerService # Attach ACR to AKS - name: attach Azure Container Registry to AKS From 2e5cb0dc217e6338e393903988f5a3f6405b6ca0 Mon Sep 17 00:00:00 2001 From: ng-jianshn Date: Fri, 13 Dec 2024 15:42:46 +0800 Subject: [PATCH 07/21] Update infra-deployment-workflow.yml --- .github/workflows/infra-deployment-workflow.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/infra-deployment-workflow.yml b/.github/workflows/infra-deployment-workflow.yml index 7f27482f..ded53d4d 100644 --- a/.github/workflows/infra-deployment-workflow.yml +++ b/.github/workflows/infra-deployment-workflow.yml @@ -41,10 +41,10 @@ jobs: failOnStdErr: false # az feature register for Lab 1 - - name: az feature register - run: | - az feature register --namespace "Microsoft.ContainerService" --name "EnableWorkloadIdentityPreview" - az provider register -n Microsoft.ContainerService + # - name: az feature register + # run: | + # az feature register --namespace "Microsoft.ContainerService" --name "EnableWorkloadIdentityPreview" + # az provider register -n Microsoft.ContainerService # Attach ACR to AKS - name: attach Azure Container Registry to AKS From 5020aeddf7efda07c909363316381589447d01c6 Mon Sep 17 00:00:00 2001 From: Jason Ng Date: Fri, 20 Dec 2024 09:45:09 +0800 Subject: [PATCH 08/21] added aks manifest --- .vscode/settings.json | 6 ++++++ AKS_manifest/samplepodtest.yaml | 17 +++++++++++++++++ AKS_manifest/serviceaccount.yaml | 9 +++++++++ 3 files changed, 32 insertions(+) create mode 100644 .vscode/settings.json create mode 100644 AKS_manifest/samplepodtest.yaml create mode 100644 AKS_manifest/serviceaccount.yaml diff --git a/.vscode/settings.json b/.vscode/settings.json new file mode 100644 index 00000000..78b2a808 --- /dev/null +++ b/.vscode/settings.json @@ -0,0 +1,6 @@ +{ + "snyk.trustedFolders": [ + "C:/Users/ngjason/Documents/AKS-DevSecOps-Workshop/AKS_manifest" + ], + "snyk.folderConfigs": [] +} \ No newline at end of file diff --git a/AKS_manifest/samplepodtest.yaml b/AKS_manifest/samplepodtest.yaml new file mode 100644 index 00000000..3c4e651a --- /dev/null +++ b/AKS_manifest/samplepodtest.yaml @@ -0,0 +1,17 @@ +apiVersion: v1 +kind: Pod +metadata: + name: quick-start + namespace: default + labels: + azure.workload.identity/use: "true" +spec: + serviceAccountName: "workload-identity-sa" + containers: + - image: ghcr.io/azure/azure-workload-identity/msal-net + name: oidc + env: + - name: KEYVAULT_URL + value: "https://akv-gnvotaqtb5nrc.vault.azure.net/" + - name: SECRET_NAME + value: "mysecret" \ No newline at end of file diff --git a/AKS_manifest/serviceaccount.yaml b/AKS_manifest/serviceaccount.yaml new file mode 100644 index 00000000..48a07848 --- /dev/null +++ b/AKS_manifest/serviceaccount.yaml @@ -0,0 +1,9 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + annotations: + azure.workload.identity/client-id: "d88fd0f6-bed5-4ed8-8d29-aa12a15fc0f6" + labels: + azure.workload.identity/use: "true" + name: "workload-identity-sa" + namespace: "default" \ No newline at end of file From 165346dbb654db2c7456c91bb274ef6436bc824f Mon Sep 17 00:00:00 2001 From: ng-jianshn Date: Fri, 20 Dec 2024 09:50:47 +0800 Subject: [PATCH 09/21] Create codeql.yml --- .github/workflows/codeql.yml | 97 ++++++++++++++++++++++++++++++++++++ 1 file changed, 97 insertions(+) create mode 100644 .github/workflows/codeql.yml diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 00000000..aa341abb --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,97 @@ +# For most projects, this workflow file will not need changing; you simply need +# to commit it to your repository. +# +# You may wish to alter this file to override the set of languages analyzed, +# or to provide custom queries or build logic. +# +# ******** NOTE ******** +# We have attempted to detect the languages in your repository. Please check +# the `language` matrix defined below to confirm you have the correct set of +# supported CodeQL languages. +# +name: "CodeQL Advanced" + +on: + push: + branches: [ "main" ] + pull_request: + branches: [ "main" ] + schedule: + - cron: '27 14 * * 5' + +jobs: + analyze: + name: Analyze (${{ matrix.language }}) + # Runner size impacts CodeQL analysis time. To learn more, please see: + # - https://gh.io/recommended-hardware-resources-for-running-codeql + # - https://gh.io/supported-runners-and-hardware-resources + # - https://gh.io/using-larger-runners (GitHub.com only) + # Consider using larger runners or machines with greater resources for possible analysis time improvements. + runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }} + permissions: + # required for all workflows + security-events: write + + # required to fetch internal or private CodeQL packs + packages: read + + # only required for workflows in private repositories + actions: read + contents: read + + strategy: + fail-fast: false + matrix: + include: + - language: java-kotlin + build-mode: none # This mode only analyzes Java. Set this to 'autobuild' or 'manual' to analyze Kotlin too. + # CodeQL supports the following values keywords for 'language': 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'swift' + # Use `c-cpp` to analyze code written in C, C++ or both + # Use 'java-kotlin' to analyze code written in Java, Kotlin or both + # Use 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both + # To learn more about changing the languages that are analyzed or customizing the build mode for your analysis, + # see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning. + # If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize how + # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages + steps: + - name: Checkout repository + uses: actions/checkout@v4 + + # Initializes the CodeQL tools for scanning. + - name: Initialize CodeQL + uses: github/codeql-action/init@v3 + with: + languages: ${{ matrix.language }} + build-mode: ${{ matrix.build-mode }} + # If you wish to specify custom queries, you can do so here or in a config file. + # By default, queries listed here will override any specified in a config file. + # Prefix the list here with "+" to use these queries and those in the config file. + + # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs + # queries: security-extended,security-and-quality + + # If the analyze step fails for one of the languages you are analyzing with + # "We were unable to automatically build your code", modify the matrix above + # to set the build mode to "manual" for that language. Then modify this step + # to build your code. + # ℹī¸ Command-line programs to run using the OS shell. + # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun + - if: matrix.build-mode == 'manual' + shell: bash + run: | + echo 'If you are using a "manual" build mode for one or more of the' \ + 'languages you are analyzing, replace this with the commands to build' \ + 'your code, for example:' + echo ' make bootstrap' + echo ' make release' + exit 1 + + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@v3 + with: + category: "/language:${{matrix.language}}" + + - name: Build Java + run: | + mvn clean package -f tools/deploy/module2/pom.xml + From 3bffbf955fc33500c057e08db8889ce14d5d730d Mon Sep 17 00:00:00 2001 From: Jason Ng Date: Fri, 20 Dec 2024 09:57:59 +0800 Subject: [PATCH 10/21] added secret yaml for test --- secrets.yaml | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) create mode 100644 secrets.yaml diff --git a/secrets.yaml b/secrets.yaml new file mode 100644 index 00000000..a0160ece --- /dev/null +++ b/secrets.yaml @@ -0,0 +1,19 @@ + apiVersion: v1 + kind: Secret + metadata: + name: secret-ssh-auth + type: kubernetes.io/ssh-auth + data: + key: + -----BEGIN DSA PRIVATE KEY----- + MIIBvAIBAAKBgQDaqdgwD3YvYwgbWzs8RQQOm8RmPztSYMUrcM7KQtdJ111sTZ/x + VAq84frCt/TEupAN5hUFkC+bpJ/diZixQgPvLKo6FVtBKy97HSpuZT8n2pUYZ9/4 + sBTR5YQtP9qExXUYO/yR+fZ+RE9w0TbSAtHW2YZHKnoowJAHdoEGMbaChQIVAK/q + iXNHCha4xHnIdD2jT0OUs03fAoGBAMnCeTgO09r2GquRAQmGFAT/6IGMhux7KOC8 + QrW7jDaqAYLiuA45E3Ira584RF2rg0VhewxcdEMbqNzqCeSKk9OAmwXpJ1J8vCUR + dRojGz0DYZHJbcspoGtZF1IF6Z3BoaggRcLX6/KYLbnzFZnBXV/+//gRTbm/V2ie + BzCWE/qEAoGBANbrGxzVTTdTD8MaVtlOpjU3RqoGFHmFCd4lv0PIt2mjFsXO3Dt/ + 6BMtJVREtb74WF0SUGmnpy6FTYoDb05j2LhH1IvCSkFT5hUK0WtAJ3NidJ6ARxxD + z2QITWI1FTr1K9NbZdR6DoTxeKfV6wWbuLywlwoWYmLe6oAmq21Oft4XAhRcKcLk + r2R/Rn1uchUL8ru0B2OVkg== + -----END DSA PRIVATE KEY----- From ef3ffbba8bdffffab517843efab1f408a7d1ec29 Mon Sep 17 00:00:00 2001 From: Jason Ng Date: Fri, 20 Dec 2024 10:11:31 +0800 Subject: [PATCH 11/21] removed secrets --- secrets.yaml | 19 ------------------- 1 file changed, 19 deletions(-) delete mode 100644 secrets.yaml diff --git a/secrets.yaml b/secrets.yaml deleted file mode 100644 index a0160ece..00000000 --- a/secrets.yaml +++ /dev/null @@ -1,19 +0,0 @@ - apiVersion: v1 - kind: Secret - metadata: - name: secret-ssh-auth - type: kubernetes.io/ssh-auth - data: - key: - -----BEGIN DSA PRIVATE KEY----- - MIIBvAIBAAKBgQDaqdgwD3YvYwgbWzs8RQQOm8RmPztSYMUrcM7KQtdJ111sTZ/x - VAq84frCt/TEupAN5hUFkC+bpJ/diZixQgPvLKo6FVtBKy97HSpuZT8n2pUYZ9/4 - sBTR5YQtP9qExXUYO/yR+fZ+RE9w0TbSAtHW2YZHKnoowJAHdoEGMbaChQIVAK/q - iXNHCha4xHnIdD2jT0OUs03fAoGBAMnCeTgO09r2GquRAQmGFAT/6IGMhux7KOC8 - QrW7jDaqAYLiuA45E3Ira584RF2rg0VhewxcdEMbqNzqCeSKk9OAmwXpJ1J8vCUR - dRojGz0DYZHJbcspoGtZF1IF6Z3BoaggRcLX6/KYLbnzFZnBXV/+//gRTbm/V2ie - BzCWE/qEAoGBANbrGxzVTTdTD8MaVtlOpjU3RqoGFHmFCd4lv0PIt2mjFsXO3Dt/ - 6BMtJVREtb74WF0SUGmnpy6FTYoDb05j2LhH1IvCSkFT5hUK0WtAJ3NidJ6ARxxD - z2QITWI1FTr1K9NbZdR6DoTxeKfV6wWbuLywlwoWYmLe6oAmq21Oft4XAhRcKcLk - r2R/Rn1uchUL8ru0B2OVkg== - -----END DSA PRIVATE KEY----- From 3afac65c17b2eb6ff7c883b579246d8e119b072d Mon Sep 17 00:00:00 2001 From: ng-jianshn Date: Fri, 20 Dec 2024 10:44:26 +0800 Subject: [PATCH 12/21] Update dependabot.yml --- .github/dependabot.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index c3cb39ee..e08822a3 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -9,3 +9,4 @@ updates: directory: "/tools/deploy/module3" # Location of package manifests schedule: interval: "weekly" + open-pull-requests-limit: "10" From 7646f54a5d935b0881000c2067e565b57b78c3ba Mon Sep 17 00:00:00 2001 From: ng-jianshn Date: Fri, 20 Dec 2024 10:49:22 +0800 Subject: [PATCH 13/21] Update dependabot.yml --- .github/dependabot.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index e08822a3..1a124c56 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -9,4 +9,4 @@ updates: directory: "/tools/deploy/module3" # Location of package manifests schedule: interval: "weekly" - open-pull-requests-limit: "10" + open-pull-requests-limit: 10 From 6a03875f40498be70c6f7703063dba9447d30e6e Mon Sep 17 00:00:00 2001 From: ng-jianshn Date: Fri, 20 Dec 2024 10:54:08 +0800 Subject: [PATCH 14/21] Update dependabot.yml --- .github/dependabot.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 1a124c56..229b3074 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -9,4 +9,4 @@ updates: directory: "/tools/deploy/module3" # Location of package manifests schedule: interval: "weekly" - open-pull-requests-limit: 10 + open-pull-requests-limit: 20 From f241c0b7c6b7a4e7bc78a52845fa5bd821d0407b Mon Sep 17 00:00:00 2001 From: Jason Ng Date: Fri, 20 Dec 2024 12:27:29 +0800 Subject: [PATCH 15/21] added secret file --- secrets.yaml | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) create mode 100644 secrets.yaml diff --git a/secrets.yaml b/secrets.yaml new file mode 100644 index 00000000..a0160ece --- /dev/null +++ b/secrets.yaml @@ -0,0 +1,19 @@ + apiVersion: v1 + kind: Secret + metadata: + name: secret-ssh-auth + type: kubernetes.io/ssh-auth + data: + key: + -----BEGIN DSA PRIVATE KEY----- + MIIBvAIBAAKBgQDaqdgwD3YvYwgbWzs8RQQOm8RmPztSYMUrcM7KQtdJ111sTZ/x + VAq84frCt/TEupAN5hUFkC+bpJ/diZixQgPvLKo6FVtBKy97HSpuZT8n2pUYZ9/4 + sBTR5YQtP9qExXUYO/yR+fZ+RE9w0TbSAtHW2YZHKnoowJAHdoEGMbaChQIVAK/q + iXNHCha4xHnIdD2jT0OUs03fAoGBAMnCeTgO09r2GquRAQmGFAT/6IGMhux7KOC8 + QrW7jDaqAYLiuA45E3Ira584RF2rg0VhewxcdEMbqNzqCeSKk9OAmwXpJ1J8vCUR + dRojGz0DYZHJbcspoGtZF1IF6Z3BoaggRcLX6/KYLbnzFZnBXV/+//gRTbm/V2ie + BzCWE/qEAoGBANbrGxzVTTdTD8MaVtlOpjU3RqoGFHmFCd4lv0PIt2mjFsXO3Dt/ + 6BMtJVREtb74WF0SUGmnpy6FTYoDb05j2LhH1IvCSkFT5hUK0WtAJ3NidJ6ARxxD + z2QITWI1FTr1K9NbZdR6DoTxeKfV6wWbuLywlwoWYmLe6oAmq21Oft4XAhRcKcLk + r2R/Rn1uchUL8ru0B2OVkg== + -----END DSA PRIVATE KEY----- From 7a3abc3b41df581a42e88846d664dc44b96d9b35 Mon Sep 17 00:00:00 2001 From: ng-jianshn Date: Fri, 20 Dec 2024 12:32:33 +0800 Subject: [PATCH 16/21] Update dependabot.yml --- .github/dependabot.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 229b3074..5a1c8e6f 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -9,4 +9,4 @@ updates: directory: "/tools/deploy/module3" # Location of package manifests schedule: interval: "weekly" - open-pull-requests-limit: 20 + # open-pull-requests-limit: 20 From 049a444968a2e23c4b1960a62d9e7b9fc55cc883 Mon Sep 17 00:00:00 2001 From: Jason Ng Date: Fri, 20 Dec 2024 12:37:00 +0800 Subject: [PATCH 17/21] removed secrets --- secrets.yaml | 19 ------------------- 1 file changed, 19 deletions(-) delete mode 100644 secrets.yaml diff --git a/secrets.yaml b/secrets.yaml deleted file mode 100644 index a0160ece..00000000 --- a/secrets.yaml +++ /dev/null @@ -1,19 +0,0 @@ - apiVersion: v1 - kind: Secret - metadata: - name: secret-ssh-auth - type: kubernetes.io/ssh-auth - data: - key: - -----BEGIN DSA PRIVATE KEY----- - MIIBvAIBAAKBgQDaqdgwD3YvYwgbWzs8RQQOm8RmPztSYMUrcM7KQtdJ111sTZ/x - VAq84frCt/TEupAN5hUFkC+bpJ/diZixQgPvLKo6FVtBKy97HSpuZT8n2pUYZ9/4 - sBTR5YQtP9qExXUYO/yR+fZ+RE9w0TbSAtHW2YZHKnoowJAHdoEGMbaChQIVAK/q - iXNHCha4xHnIdD2jT0OUs03fAoGBAMnCeTgO09r2GquRAQmGFAT/6IGMhux7KOC8 - QrW7jDaqAYLiuA45E3Ira584RF2rg0VhewxcdEMbqNzqCeSKk9OAmwXpJ1J8vCUR - dRojGz0DYZHJbcspoGtZF1IF6Z3BoaggRcLX6/KYLbnzFZnBXV/+//gRTbm/V2ie - BzCWE/qEAoGBANbrGxzVTTdTD8MaVtlOpjU3RqoGFHmFCd4lv0PIt2mjFsXO3Dt/ - 6BMtJVREtb74WF0SUGmnpy6FTYoDb05j2LhH1IvCSkFT5hUK0WtAJ3NidJ6ARxxD - z2QITWI1FTr1K9NbZdR6DoTxeKfV6wWbuLywlwoWYmLe6oAmq21Oft4XAhRcKcLk - r2R/Rn1uchUL8ru0B2OVkg== - -----END DSA PRIVATE KEY----- From 6cd3cd8e64e0965ce292245b002ed47c3b31125e Mon Sep 17 00:00:00 2001 From: ng-jianshn Date: Fri, 20 Dec 2024 12:51:31 +0800 Subject: [PATCH 18/21] Update mod4-credential.json --- tools/deploy/module4/mod4-credential.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/deploy/module4/mod4-credential.json b/tools/deploy/module4/mod4-credential.json index 4080ea07..3e3aab54 100644 --- a/tools/deploy/module4/mod4-credential.json +++ b/tools/deploy/module4/mod4-credential.json @@ -1,7 +1,7 @@ { "name": "gha-mod4-oidc", "issuer": "https://token.actions.githubusercontent.com", - "subject": "repo:/AKS-DevSecOps-Workshop:environment:test", + "subject": "repo:ng-jianshn/AKS-DevSecOps-Workshop:environment:test", "audiences": ["api://AzureADTokenExchange"], "description": "Workload Identity for AKS DevSecOps repo - Mod 4" } From 01eaf9c3f23d9ab1dd61dbd0e1bad094eb07b909 Mon Sep 17 00:00:00 2001 From: Jason Ng Date: Fri, 20 Dec 2024 12:59:04 +0800 Subject: [PATCH 19/21] created test workflow --- .../module4 => .github/workflows}/mod4-lab1-deploy-test.yml | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename {tools/deploy/module4 => .github/workflows}/mod4-lab1-deploy-test.yml (100%) diff --git a/tools/deploy/module4/mod4-lab1-deploy-test.yml b/.github/workflows/mod4-lab1-deploy-test.yml similarity index 100% rename from tools/deploy/module4/mod4-lab1-deploy-test.yml rename to .github/workflows/mod4-lab1-deploy-test.yml From 4342b6c5d80337fcfaed78d1c38a603105bad041 Mon Sep 17 00:00:00 2001 From: ng-jianshn Date: Fri, 20 Dec 2024 13:02:17 +0800 Subject: [PATCH 20/21] Update text.txt --- tools/deploy/module4/text.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/deploy/module4/text.txt b/tools/deploy/module4/text.txt index 2e65efe2..e1894ce0 100644 --- a/tools/deploy/module4/text.txt +++ b/tools/deploy/module4/text.txt @@ -1 +1 @@ -a \ No newline at end of file +hello jason here From 6c73956d121c231a19f438379d228766d4867164 Mon Sep 17 00:00:00 2001 From: ng-jianshn Date: Fri, 20 Dec 2024 13:42:11 +0800 Subject: [PATCH 21/21] Update deployment-manifest-test-sample.yaml --- tools/deploy/module4/deployment-manifest-test-sample.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tools/deploy/module4/deployment-manifest-test-sample.yaml b/tools/deploy/module4/deployment-manifest-test-sample.yaml index 06218c46..448979dd 100644 --- a/tools/deploy/module4/deployment-manifest-test-sample.yaml +++ b/tools/deploy/module4/deployment-manifest-test-sample.yaml @@ -5,7 +5,7 @@ metadata: spec: containers: - name: devsecops-mod4-nginx-app - image: nginx:latest + image: acrgnvotaqtb5nrc.azurecr.io/nginx:latest ports: - containerPort: 80 - containerPort: 443 @@ -15,4 +15,4 @@ spec: memory: 8Mi limits: cpu: 500m - memory: 32Mi \ No newline at end of file + memory: 32Mi